Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    30-06-2022 05:39

General

  • Target

    INV No. SMEPL03122-23 & PL.pdf.exe

  • Size

    578KB

  • MD5

    59596155c337dcf53ce09d9fe86a289f

  • SHA1

    613ef8cb6aa875f406905f68d4e42e4509e36bb9

  • SHA256

    b575be29720f27a08220d8b155e68bb70cd1f0d3a9a3bfb261873f3fa639d6b6

  • SHA512

    350d8812c71eed902334ec66efc15a916ecd91a97f789b75d57674a249be0738a9b41dcdc8229fed99f4e5cf7b1194c0b49e1045803e3513a0557d9ae43af52f

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ba17

Decoy

bearwant.com

sdsguanfang.com

steamcommunityvia.top

sugarplumtreasures.com

koronislakefishing.com

jmae.xyz

xhxnqemkiqe.xyz

playzcrew.com

zatwsbq.com

lankofix.com

sh-zhepeng.com

mibodamisxv.online

butterflyjewelry.store

finestrecitalto-spottoday.info

globomateria.com

royalmdarts.com

d4af10836709.com

shepwill.com

67aldrich.info

trustedmakers.club

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3128
    • C:\Users\Admin\AppData\Local\Temp\INV No. SMEPL03122-23 & PL.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\INV No. SMEPL03122-23 & PL.pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Users\Admin\AppData\Local\Temp\INV No. SMEPL03122-23 & PL.pdf.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1236
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:784
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\INV No. SMEPL03122-23 & PL.pdf.exe"
        3⤵
          PID:1588

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/784-146-0x0000000003010000-0x000000000335A000-memory.dmp
      Filesize

      3.3MB

    • memory/784-141-0x0000000000000000-mapping.dmp
    • memory/784-149-0x0000000000F10000-0x0000000000F3F000-memory.dmp
      Filesize

      188KB

    • memory/784-147-0x0000000002F60000-0x0000000002FF4000-memory.dmp
      Filesize

      592KB

    • memory/784-145-0x0000000000F10000-0x0000000000F3F000-memory.dmp
      Filesize

      188KB

    • memory/784-144-0x0000000000060000-0x0000000000493000-memory.dmp
      Filesize

      4.2MB

    • memory/1236-135-0x0000000000000000-mapping.dmp
    • memory/1236-139-0x0000000000CF0000-0x0000000000D05000-memory.dmp
      Filesize

      84KB

    • memory/1236-136-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1236-138-0x0000000001080000-0x00000000013CA000-memory.dmp
      Filesize

      3.3MB

    • memory/1236-142-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1588-143-0x0000000000000000-mapping.dmp
    • memory/2712-131-0x0000000005760000-0x0000000005D04000-memory.dmp
      Filesize

      5.6MB

    • memory/2712-134-0x0000000005270000-0x000000000527A000-memory.dmp
      Filesize

      40KB

    • memory/2712-130-0x0000000000780000-0x0000000000816000-memory.dmp
      Filesize

      600KB

    • memory/2712-133-0x00000000052F0000-0x000000000538C000-memory.dmp
      Filesize

      624KB

    • memory/2712-132-0x00000000051B0000-0x0000000005242000-memory.dmp
      Filesize

      584KB

    • memory/3128-148-0x0000000008E00000-0x0000000008F3A000-memory.dmp
      Filesize

      1.2MB

    • memory/3128-140-0x00000000033A0000-0x0000000003479000-memory.dmp
      Filesize

      868KB

    • memory/3128-150-0x0000000008E00000-0x0000000008F3A000-memory.dmp
      Filesize

      1.2MB